Two of the big American companies that could be affected if the rules come into force — public comment has been sought until 3 March — are Amazon and Flipkart which were already hit by regulations that came in on 1 February and make it illegal for companies to hawk products through firms in which they have an equity interest. Additionally, companies will not be permitted to cut deals for any other seller to push products exclusively on their platforms.
The draft lists numerous conditions for conducting e-commerce in the country. "Today, just a handful of companies have managed to dominate the digital economy," it says. "Because of the significant first mover advantage, once a certain scale is reached, it becomes virtually impossible for a ‘second mover’ to, on its own, make an entry in the market. Globally, small beginnings have been made for communities to take some control over their own data."
It says any entity that wants to conduct e-commerce in India must have a registered business entity in the country, something many smaller operators do not have.
"India and its citizens have a sovereign right to their data. This right cannot be extended to non-Indians (the same way that non-Indians do not have any prima-facie right or claim to, say, an Indian coal mine). This understanding flows from the acknowledgement that data about an Indian, is his/her own," the 42-page draft says.
"Even after anonymisation, the interests of the individual cannot be completely separated from the derivatives that may be obtained by analysing and drawing inferences from a certain set of data."
Foreign companies will incur additional costs if they have to switch from storing in their existing data centres outside India to servers within India. Additionally, their business processes may have to be changed to accommodate this demand. The draft rules say companies will get three years to fall in line with this requirement once the rules come into force.
The draft acknowledges, however, that there are cases where Indians may generate data that gets stored outside the country: data collected by IoT devices installed in public space and data generated by users in India by various sources, including e-commerce platforms, social media, search engines etc.
It lays down the following proposed rules for data in the event that it is stored abroad:
A business entity that collects or processes any sensitive data in India and stores it abroad, shall be required to adhere to the following conditions:
a) All such data stored abroad shall not be made available to other business entities outside India, for any purpose, even with the customer's consent;
b) All such data stored abroad shall not be made available to a third party, for any purpose, even if the customer consents to it;
c) All such data stored abroad shall not be made available to a foreign government, without the prior permission of Indian authorities;
d) A request from Indian authorities to have access to all such data stored abroad, shall be complied with immediately;
e) Any violation of the conditions mentioned above shall face the prescribed consequences (to be formulated by the government).
India will hold its federal election, the biggest such exercise in a democratic country, in May, and many commentators have hinted that these rules and many other changes being introduced by the government are a bid to boost its ratings ahead of the polls.
Contacted for comment, an Amazon spokesperson told iTWire: "We are currently studying the draft policy and we will provide our inputs during the public review period. We look forward to an enabling policy to serve over 450,000 sellers and a policy that will allow us to scale up our logistics network, create new jobs and infrastructure, digitise payments and delight our customers."
Flipkart has no media contact address on its website and hence was not contacted.